I have an engineering background, but I primarily communicate with entrepreneurs and production managers. Some time ago, an owner of an industrial company reached out for advice. Despite the company being large and established in the 90s, its management and accounting still operate in an outdated local network.
This is a consequence of concerns for their business and increased government oversight. Laws and regulations can be interpreted very broadly by regulatory bodies. A good example is the amendments to the Tax Code, for tax violations, essentially dismantling .
As a result, the business owner began to seek solutions for secure information storage and safe document transmission. A virtual 'vault'.
The task was discussed with the in-house system administrator: a thorough analysis of existing platforms is needed.
- The service should not be cloud-based in the traditional sense of the word, i.e., without storing data on the resources of a third party. Only our own server;
- robust encryption of transmitted and stored data is required;
- an emergency content deletion feature from any device at the push of a button is mandatory;
- the solution was developed abroad.
I suggested removing the fourth point, as Russian applications have official certifications. The director bluntly stated what should be done with such certifications.
We evaluate options
I selected three solutions (the more options, the more doubts):
- Open Source — project , supported by enthusiast-developer Jacob Borg.
- , managed by the American company Resilio Inc. (previously, this service was called BitTorrent Sync).
- Project from synchronization applications. Registered in Cyprus.
The company owner is not very familiar with technical details, so I prepared the report in the form of lists of pros and cons for each option.
Analysis Summary
Syncthing
Advantages:
- Open source;
- Active lead developer;
- The project has been around for a long time;
- Free.
Cons:
- No client for iOS shell;
- Slow Turn servers (they are free, so they lag). For those who
are not in the know, Turn is used when a direct connection is not possible; - Complex interface setup (requires many years of programming experience);
- Lack of prompt commercial support.
Resilio
Pros: support for all devices and fast Turn servers.
Cons: One very significant issue – complete disregard by support for any inquiries. Zero response, even when writing from different addresses.
Pvtbox
Pros:
- Support for all devices;
- Fast Turn servers;
- Ability to download files without installing an application;
- Adequate support service, including by phone.
Cons:
- Young project (few reviews and good assessments);
- Very 'techy' interface of the website that is not always clear;
- No thoroughly detailed documentation, many issues require contacting support.
What the client chose
His first question: what's the point of developing something for free? They immediately rejected Syncthing. The arguments didn't work.
A couple of days later, the client categorically dismissed Resilio Sync due to lack of support, as it was unclear whom to contact in an emergency situation. Plus, mistrust of the company's American registration.
For further analysis, we kept Pvtbox Electronic Safe. We conducted a full technical audit of this platform focusing on the possibility of interception, decryption of data, and unauthorized access to the information storage.
Audit process
We analyzed connections at the program startup, during operation, and in idle states. The traffic is initially encrypted by modern standards. We will try to conduct a MITM attack and replace the certificate 'on the fly' using Linux (Xubuntu Linux 18.04), Wireshark, Mitmproxy. To do this, we will implement a middleman between the Pvtbox application and the server pvtbox.net (there is data exchange with the pvtbox.net server over https connection).
We launch the application to ensure that the program and file synchronization work. In Linux, you can monitor the logging instantly if you run the program from the terminal.
We shut down the application and replace the host address pvtbox.net in the file /etc/hosts with superuser privileges. We change the address to our proxy server's address.
Now we will prepare our proxy server for a MITM attack on a computer with the address 192.168.1.64 in our local network. To do this, we will install the mitmproxy package version 4.0.4.
We launch the proxy server on port 443:
$ sudo mitmproxy -p 443
We run the Pvtbox program on the first computer, watching the output from mitmproxy and the application's logs.
Mitmproxy indicates that the client does not trust the proxy server's forged certificate. The application logs also show that the proxy server's certificate fails validation, and the program refuses to run.
We install the proxy server's certificate mitmproxy on the computer with the Pvtbox application to make the certificate 'trusted'. We will install the ca-certificates package on the computer. Then we will copy the mitmproxy-ca-cert.pem certificate from the .mitmproxy directory of the proxy server to the computer with the Pvtbox application in the /usr/local/share/ca-certificates directory.
We execute the commands:
$ sudo openssl x509 -in mitmproxy-ca-cert.pem -inform PEM -out mitmproxy-ca-cert.crt
$ sudo update-ca-certificates
We launch the Pvtbox application. The certificate fails validation again, and the program refuses to run. The application likely employs a security mechanism Certificate pinning.
A similar attack was carried out on the host signalserver.pvtbox.net, as well as on the peer-to-peer connection itself between nodes. The developer states that the application for establishing peer-to-peer connections uses an open protocol webrtc, which incorporates end-to-end encryption via the DTLSv1.2.
Keys are generated for each connection setup and are transmitted over an encrypted channel through signalserver.pvtbox.net.
Theoretically, it would be possible to intercept the offer and answer messages of webrtc, replace the encryption keys there, and be able to decrypt all messages coming through webrtc. However, conducting a mitm attack on signalserver.pvtbox.net was unsuccessful, thus there’s no possibility to intercept and replace messages sent through signalserver.pvtbox.net.
Accordingly, it is not possible to conduct this attack on peer-to-peer connections.
A file with certificates supplied with the program was also found. The file is located at /opt/pvtbox/certifi/cacert.pem. This file was replaced with one that contains a trusted certificate from our mitmproxy server. The result did not change — the program refused to connect to the system, and the same error was observed in the log,
indicating that the certificate failed validation.
Audit results
I was unable to intercept or manipulate the traffic. File names, and especially their content, are transmitted in an encrypted form, employing end-to-end encryption. The application implements a series of protective mechanisms to prevent eavesdropping and injection.
As a result, the company purchased two dedicated servers (physically located in different places) for permanent access to information. The first server is used for receiving, processing, and storing information, while the second is for backup.
The newly created private cloud was connected to the director's workstation and an iOS mobile phone. Other employees were connected by the in-house sysadmin and Pvtbox technical support.
There have been no complaints from the acquaintance during this time. I hope my review helps readers on Habr in similar situations.
Source: habr.com
